OLD | NEW |
1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | |
5 #include "remoting/host/security_key/gnubby_auth_handler_linux.h" | |
6 | |
7 #include <stdint.h> | 4 #include <stdint.h> |
8 #include <unistd.h> | 5 #include <unistd.h> |
9 | 6 |
10 #include "base/bind.h" | 7 #include "base/bind.h" |
11 #include "base/files/file_util.h" | 8 #include "base/files/file_util.h" |
12 #include "base/lazy_instance.h" | 9 #include "base/lazy_instance.h" |
13 #include "base/logging.h" | 10 #include "base/logging.h" |
| 11 #include "base/memory/scoped_ptr.h" |
14 #include "base/stl_util.h" | 12 #include "base/stl_util.h" |
| 13 #include "base/threading/thread_checker.h" |
15 #include "base/threading/thread_restrictions.h" | 14 #include "base/threading/thread_restrictions.h" |
16 #include "base/values.h" | 15 #include "base/values.h" |
| 16 #include "net/base/completion_callback.h" |
17 #include "net/base/net_errors.h" | 17 #include "net/base/net_errors.h" |
| 18 #include "net/socket/stream_socket.h" |
18 #include "net/socket/unix_domain_server_socket_posix.h" | 19 #include "net/socket/unix_domain_server_socket_posix.h" |
19 #include "remoting/base/logging.h" | 20 #include "remoting/base/logging.h" |
| 21 #include "remoting/host/security_key/gnubby_auth_handler.h" |
20 #include "remoting/host/security_key/gnubby_socket.h" | 22 #include "remoting/host/security_key/gnubby_socket.h" |
21 | 23 |
22 namespace { | 24 namespace { |
23 | 25 |
24 const int64_t kDefaultRequestTimeoutSeconds = 60; | 26 const int64_t kDefaultRequestTimeoutSeconds = 60; |
25 | 27 |
26 // The name of the socket to listen for gnubby requests on. | 28 // The name of the socket to listen for gnubby requests on. |
27 base::LazyInstance<base::FilePath>::Leaky g_gnubby_socket_name = | 29 base::LazyInstance<base::FilePath>::Leaky g_gnubby_socket_name = |
28 LAZY_INSTANCE_INITIALIZER; | 30 LAZY_INSTANCE_INITIALIZER; |
29 | 31 |
30 // Socket authentication function that only allows connections from callers with | 32 // Socket authentication function that only allows connections from callers with |
31 // the current uid. | 33 // the current uid. |
32 bool MatchUid(const net::UnixDomainServerSocket::Credentials& credentials) { | 34 bool MatchUid(const net::UnixDomainServerSocket::Credentials& credentials) { |
33 bool allowed = credentials.user_id == getuid(); | 35 bool allowed = credentials.user_id == getuid(); |
34 if (!allowed) | 36 if (!allowed) |
35 HOST_LOG << "Refused socket connection from uid " << credentials.user_id; | 37 HOST_LOG << "Refused socket connection from uid " << credentials.user_id; |
36 return allowed; | 38 return allowed; |
37 } | 39 } |
38 | 40 |
39 // Returns the command code (the first byte of the data) if it exists, or -1 if | 41 // Returns the command code (the first byte of the data) if it exists, or -1 if |
40 // the data is empty. | 42 // the data is empty. |
41 unsigned int GetCommandCode(const std::string& data) { | 43 unsigned int GetCommandCode(const std::string& data) { |
42 return data.empty() ? -1 : static_cast<unsigned int>(data[0]); | 44 return data.empty() ? -1 : static_cast<unsigned int>(data[0]); |
43 } | 45 } |
44 | 46 |
45 } // namespace | 47 } // namespace |
46 | 48 |
47 namespace remoting { | 49 namespace remoting { |
48 | 50 |
| 51 class GnubbyAuthHandlerLinux : public GnubbyAuthHandler { |
| 52 public: |
| 53 GnubbyAuthHandlerLinux(); |
| 54 ~GnubbyAuthHandlerLinux() override; |
| 55 |
| 56 private: |
| 57 typedef std::map<int, GnubbySocket*> ActiveSockets; |
| 58 |
| 59 // GnubbyAuthHandler interface. |
| 60 void CreateGnubbyConnection() override; |
| 61 bool IsValidConnectionId(int gnubby_connection_id) const override; |
| 62 void SendClientResponse(int gnubby_connection_id, |
| 63 const std::string& response) override; |
| 64 void SendErrorAndCloseConnection(int gnubby_connection_id) override; |
| 65 void SetSendMessageCallback(const SendMessageCallback& callback) override; |
| 66 size_t GetActiveConnectionCountForTest() const override; |
| 67 void SetRequestTimeoutForTest(const base::TimeDelta& timeout) override; |
| 68 |
| 69 // Starts listening for connection. |
| 70 void DoAccept(); |
| 71 |
| 72 // Called when a connection is accepted. |
| 73 void OnAccepted(int result); |
| 74 |
| 75 // Called when a GnubbySocket has done reading. |
| 76 void OnReadComplete(int gnubby_connection_id); |
| 77 |
| 78 // Gets an active socket iterator for |gnubby_connection_id|. |
| 79 ActiveSockets::const_iterator GetSocketForConnectionId( |
| 80 int gnubby_connection_id) const; |
| 81 |
| 82 // Send an error and closes an active socket. |
| 83 void SendErrorAndCloseActiveSocket(const ActiveSockets::const_iterator& iter); |
| 84 |
| 85 // A request timed out. |
| 86 void RequestTimedOut(int gnubby_connection_id); |
| 87 |
| 88 // Ensures GnubbyAuthHandlerLinux methods are called on the same thread. |
| 89 base::ThreadChecker thread_checker_; |
| 90 |
| 91 // Socket used to listen for authorization requests. |
| 92 scoped_ptr<net::UnixDomainServerSocket> auth_socket_; |
| 93 |
| 94 // A temporary holder for an accepted connection. |
| 95 scoped_ptr<net::StreamSocket> accept_socket_; |
| 96 |
| 97 // Used to pass gnubby extension messages to the client. |
| 98 SendMessageCallback send_message_callback_; |
| 99 |
| 100 // The last assigned gnubby connection id. |
| 101 int last_connection_id_; |
| 102 |
| 103 // Sockets by connection id used to process gnubbyd requests. |
| 104 ActiveSockets active_sockets_; |
| 105 |
| 106 // Timeout used for a request. |
| 107 base::TimeDelta request_timeout_; |
| 108 |
| 109 DISALLOW_COPY_AND_ASSIGN(GnubbyAuthHandlerLinux); |
| 110 }; |
| 111 |
49 scoped_ptr<GnubbyAuthHandler> GnubbyAuthHandler::Create( | 112 scoped_ptr<GnubbyAuthHandler> GnubbyAuthHandler::Create( |
50 const SendMessageCallback& callback) { | 113 const SendMessageCallback& callback) { |
51 scoped_ptr<GnubbyAuthHandler> auth_handler(new GnubbyAuthHandlerLinux()); | 114 scoped_ptr<GnubbyAuthHandler> auth_handler(new GnubbyAuthHandlerLinux()); |
52 auth_handler->SetSendMessageCallback(callback); | 115 auth_handler->SetSendMessageCallback(callback); |
53 return auth_handler; | 116 return auth_handler; |
54 } | 117 } |
55 | 118 |
56 void GnubbyAuthHandler::SetGnubbySocketName( | 119 void GnubbyAuthHandler::SetGnubbySocketName( |
57 const base::FilePath& gnubby_socket_name) { | 120 const base::FilePath& gnubby_socket_name) { |
58 g_gnubby_socket_name.Get() = gnubby_socket_name; | 121 g_gnubby_socket_name.Get() = gnubby_socket_name; |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
126 LOG(WARNING) << "Unknown gnubby-auth data connection: '" | 189 LOG(WARNING) << "Unknown gnubby-auth data connection: '" |
127 << gnubby_connection_id << "'"; | 190 << gnubby_connection_id << "'"; |
128 } | 191 } |
129 } | 192 } |
130 | 193 |
131 void GnubbyAuthHandlerLinux::SetSendMessageCallback( | 194 void GnubbyAuthHandlerLinux::SetSendMessageCallback( |
132 const SendMessageCallback& callback) { | 195 const SendMessageCallback& callback) { |
133 send_message_callback_ = callback; | 196 send_message_callback_ = callback; |
134 } | 197 } |
135 | 198 |
136 size_t GnubbyAuthHandlerLinux::GetActiveSocketsMapSizeForTest() const { | 199 size_t GnubbyAuthHandlerLinux::GetActiveConnectionCountForTest() const { |
137 return active_sockets_.size(); | 200 return active_sockets_.size(); |
138 } | 201 } |
139 | 202 |
140 void GnubbyAuthHandlerLinux::SetRequestTimeoutForTest( | 203 void GnubbyAuthHandlerLinux::SetRequestTimeoutForTest( |
141 const base::TimeDelta& timeout) { | 204 const base::TimeDelta& timeout) { |
142 request_timeout_ = timeout; | 205 request_timeout_ = timeout; |
143 } | 206 } |
144 | 207 |
145 void GnubbyAuthHandlerLinux::DoAccept() { | 208 void GnubbyAuthHandlerLinux::DoAccept() { |
146 int result = auth_socket_->Accept( | 209 int result = auth_socket_->Accept( |
(...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
208 | 271 |
209 void GnubbyAuthHandlerLinux::RequestTimedOut(int gnubby_connection_id) { | 272 void GnubbyAuthHandlerLinux::RequestTimedOut(int gnubby_connection_id) { |
210 HOST_LOG << "Gnubby request timed out"; | 273 HOST_LOG << "Gnubby request timed out"; |
211 ActiveSockets::const_iterator iter = | 274 ActiveSockets::const_iterator iter = |
212 active_sockets_.find(gnubby_connection_id); | 275 active_sockets_.find(gnubby_connection_id); |
213 if (iter != active_sockets_.end()) | 276 if (iter != active_sockets_.end()) |
214 SendErrorAndCloseActiveSocket(iter); | 277 SendErrorAndCloseActiveSocket(iter); |
215 } | 278 } |
216 | 279 |
217 } // namespace remoting | 280 } // namespace remoting |
OLD | NEW |